Workspace: Service Accounts

An IT compliance manager who runs integrations into SmartSuite faced the same audit question every quarter: what can this integration reach, and who owns it. Until now every integration ran on a person's API key, with that person's full access, and it stopped working the day the account was deactivated. Service accounts separate the integration from the employee. A service account is a non-human identity owned by the workspace, created by an Administrator in Workspace Administration. It has a named owner and a backup owner, OAuth 2.0 or an API token, a client secret expiration with a rotation policy, and its own rate limits, usage alerts and allowed IP ranges. Access is granted one solution, table and scope at a time. The account cannot sign in to the interface and does not consume a paid seat. The list view shows every account with its authentication method, status and last use, so access reviews cover machine identities with the same evidence as people. Available now in Workspace Administration.

Key highlights

• Workspace-owned identity. A service account belongs to the workspace rather than an employee, so an integration keeps running through role changes and departures. It does not consume a paid seat or allow interface sign-in.
• Least-privilege access. Grant each account just the solutions, tables and scopes it needs, chosen one at a time, instead of inheriting whatever its creator happens to have.
• Named, revocable credentials. Generate a key with a name you will recognize in logs, copy the full value the one time it is shown, and revoke it on its own without disturbing the account's other keys.
• Rotation built in. Set a client secret expiration and a rotation policy, see the resolved expiry date on the account, and rotate with overlap so integrations keep working at cutover.
• Access reviews. Every account carries a named owner, a backup owner, its authentication method, its granted scopes and its last-used date. A quarterly review covers non-human identities with the same evidence you collect for people.
• Contained blast radius. Rate limits, usage alerts and allowed IP ranges bound what a credential can do even if it is exposed.

How it works

1. Open Service Accounts under Workspace Administration to see every account with its authentication method, status and last use.
2. Create an account through the guided flow of four steps: Details, Authentication, Security and Access.
3. In Details, name the account, describe what it is for, and assign a named owner and a backup owner who takes over if the owner is deactivated.
4. In Authentication, choose OAuth 2.0 for system-to-system integrations or an API token for simple scripts, then set the client secret expiration and rotation policy.
5. In Security, set rate limits, usage alerts and any allowed IP ranges the account's credentials are restricted to.
6. In Access, add the solutions and tables the account may reach and pick a scope for each one, such as reading or writing records.
7. Generate a key, copy it straight into your secrets manager, and revoke or rotate it later from the account's Keys section.
8. Disable an account from its status toggle to cut off access immediately without losing its configuration.

Help article: Service Accounts in SmartSuite